- Freeradius-Users - lists.freeradius.org

Migrating from Cisco Access Registrar to FreeRADIUS<freeradius-users@lists.freeradius.org>,
by Fahad Saleem 20 Dec '13

20 Dec '13

Hello All, Let me just say I'm a big fan of the work being done by Freeradius. We've been thinking of ditching our Cisco Access Registrar (AAA) for sometime now as we've been facing many issues with it, massive memory leakage being one of them. For this purpose we did some testing with Freeradius and one of our NAS gear, Samsung General ATM Switching Network (GAN) deployed in a 3GPP2 EV-DO environment for the purpose of hardware autentication only. Things didn't go too well however, following is the output of radiusd -X Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.24 port 1812, id=252, length=88 User-Name = "92421013626" CHAP-Password = 0x01ef28b52424c1b5f35683fb12ffb371f8 NAS-IP-Address = 172.16.1.24 CHAP-Challenge = 0xfd2f308b721c8fbbd198087e43ed71f0 3GPP2-Attr-60 = 0x00000001 +- entering group authorize {...} ++[preprocess] returns ok Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop No '@' in User-Name = "92421013626", looking up realm NULL No such realm "NULL" ++[suffix] returns noop No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry 92421013626 at line 85 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} login attempt by "92421013626" with CHAP password Using clear text password "0D2379B0" for user 92421013626 authentication. chap user 92421013626 authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 252 to 172.16.1.24 port 1812 Callback-Id = "410530421013626" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 252 with timestamp +5 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.24 port 1812, id=253, length=88 User-Name = "92421013626" CHAP-Password = 0x01ff3da64a9d26f7eddeb6043deafcdc5b NAS-IP-Address = 172.16.1.24 CHAP-Challenge = 0x79bc887e81bdff4ebacb6bacd26945f9 3GPP2-Attr-60 = 0x00000001 +- entering group authorize {...} ++[preprocess] returns ok Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop No '@' in User-Name = "92421013626", looking up realm NULL No such realm "NULL" ++[suffix] returns noop No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry 92421013626 at line 85 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} login attempt by "92421013626" with CHAP password Using clear text password "0D2379B0" for user 92421013626 authentication. chap user 92421013626 authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 253 to 172.16.1.24 port 1812 Callback-Id = "410530421013626" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 253 with timestamp +39 Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.24 port 1812, id=254, length=88 User-Name = "92421013626" CHAP-Password = 0x0122be6028d9a8501e7df9d2da160d5366 NAS-IP-Address = 172.16.1.24 CHAP-Challenge = 0x7db1dfd61694cc5d964c6ceb1f15dd67 3GPP2-Attr-60 = 0x00000001 +- entering group authorize {...} ++[preprocess] returns ok Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop No '@' in User-Name = "92421013626", looking up realm NULL No such realm "NULL" ++[suffix] returns noop No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry 92421013626 at line 85 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} login attempt by "92421013626" with CHAP password Using clear text password "0D2379B0" for user 92421013626 authentication. chap user 92421013626 authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 254 to 172.16.1.24 port 1812 Callback-Id = "410530421013626" Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 254 with timestamp +62 Ready to process requests. As you can see freeradius is sending an access accept with the callback-id to the client but nothing happens afterwards and the user is unable to connect. From what I've been able to understand the NAS is sending a 3GPP2-Attr-60 = 0x00000001 which is the 3GPP2-HRPD-Access-Authentication which in not defined in the 3GPP2 dictionary, would patching the 3GPP2 dictionary do the trick or is there something else I am missing? as this VSA is I would've tested this already however this kind of testing requires approval from other departements as well which is gonna take a couple of days

4 3

pap normalizing ssha1-password from base64 encoding segmentation fault
by Marco Aresu 20 Dec '13

20 Dec '13

Hi all during the debug of Radiusd i ve got the follow error : "pap normalizing ssha1-password from base64 encoding segmentation fault I am using freeradius-2.1.12 Any could help me? I tried to read some topic but i didn't find the real solution. The OS is CentOS and there isn't any upgrade available for Freeradius. Thanks Marco Aresu

2 1

Error setting up a home_server_pool
by Alberto Martínez 20 Dec '13

20 Dec '13

Hi. I'm having trouble when setting up a home_server_pool. FR version is 3.0.0 home_server edited1.example.org { type = auth ipaddr = <ipv4> port = 1812 secret = <edited> response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server edited2.example.org { type = auth ipaddr = <ipv4> port = 1812 secret = <edited> response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool my_pool { type = client-balance home_server = edited1.example.org home_server = edited2.example.org } This fails with a misleading message: Unknown home_server " edited1.example.org" However, when home_server type is auth+acct it works. Am i missing something? Is this an expected behaviour?

3 3

Re: FR 3.0 with eDir
by Hubert Kupper 19 Dec '13

19 Dec '13

Am 18.12.2013 10:54, schrieb Hubert Kupper: > Am 18.12.2013 10:16, schrieb Olivier Beytrison: >> On 18.12.2013 09:56, Hubert Kupper wrote: >>> Bingo. You are right. When I use ldaps the ldap bind was successful >>> now. >>> With FR 2.x on OpenSuse 12.3 ldap and ldaps work both. >> Good news ! >> >>> (9) ldap : Added eDirectory password in check items as >>> Cleartext-Password = pwddummy >> Is that the password you used to test the authentication ? >> >>> (9) mschap : Creating challenge hash with username: dumm >>> (9) mschap : Client is using MS-CHAPv2 for dumm, we need NT-Password >>> (9) mschap : FAILED: MS-CHAP2-Response is incorrect >>> (9) [mschap] = reject >> It looks like you provided the wrong password. >> >> Olivier > no, I used "pwddummy" only in my posting. In my tests I used the right > password for the testuser dumm. With our other FR servers, the > testuser and password works fine! > > Hubert > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html Ok, I resetted the password for user dumm and tried it again. Here is the output: Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=172, length=213 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020200090164756d6d Message-Authenticator = 0x19d1460f5e754fa9589131e27aa1631b (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (!User-Name) (0) ? if (!User-Name) -> FALSE (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'dumm' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "dumm", looking up realm NULL (0) suffix : Found realm "NULL" (0) suffix : Adding Stripped-User-Name = "dumm" (0) suffix : Adding Realm = "NULL" (0) suffix : Authentication realm is LOCAL (0) [suffix] = ok (0) eap : EAP packet type response id 2 length 9 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent Identity (1) (0) eap : Calling eap_peap to process EAP data (0) eap_peap : Flushing SSL sessions (of #0) (0) eap_peap : Initiate (0) eap_peap : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfa867997d (0) [eap] = handled (0) } # authenticate = handled Sending Access-Challenge of id 172 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfa867997d12828dafc6890954 (0) Finished request 0. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=173, length=327 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x0203006919800000005f160301005a01000056030152b1966ea0268f428ae5f5a4c8c1c0d1b6ad2fa9945b4b8f9d132cce1a818aec000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0xa86480cfa867997d12828dafc6890954 Message-Authenticator = 0xb4bdc760cfea245ec3ae498b0e0303a8 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) ? if (!User-Name) (1) ? if (!User-Name) -> FALSE (1) ? if (User-Name != "%{tolower:%{User-Name}}") (1) expand: "%{tolower:%{User-Name}}" -> 'dumm' (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) ? if (User-Name =~ / /) (1) ? if (User-Name =~ / /) -> FALSE (1) ? if (User-Name =~ /@.*@/ ) (1) ? if (User-Name =~ /@.*@/ ) -> FALSE (1) ? if (User-Name =~ /\\.\\./ ) (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (1) ? if (User-Name =~ /\\.$/) (1) ? if (User-Name =~ /\\.$/) -> FALSE (1) ? if (User-Name =~ /(a)\\./) (1) ? if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "dumm", looking up realm NULL (1) suffix : Found realm "NULL" (1) suffix : Adding Stripped-User-Name = "dumm" (1) suffix : Adding Realm = "NULL" (1) suffix : Authentication realm is LOCAL (1) [suffix] = ok (1) eap : EAP packet type response id 3 length 105 (1) eap : Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0xa86480cfa867997d (1) eap : Finished EAP session with state 0xa86480cfa867997d (1) eap : Previous EAP request found for state 0xa86480cfa867997d, released from the list (1) eap : Peer sent PEAP (25) (1) eap : EAP PEAP (25) (1) eap : Calling eap_peap to process EAP data (1) eap_peap : processing EAP-TLS TLS Length 95 (1) eap_peap : Length Included (1) eap_peap : eaptls_verify returned 11 (1) eap_peap : (other): before/accept initialization (1) eap_peap : TLS_accept: before/accept initialization (1) eap_peap : <<< TLS 1.0 Handshake [length 005a], ClientHello (1) eap_peap : TLS_accept: SSLv3 read client hello A (1) eap_peap : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) eap_peap : TLS_accept: SSLv3 write server hello A (1) eap_peap : >>> TLS 1.0 Handshake [length 12e2], Certificate (1) eap_peap : TLS_accept: SSLv3 write certificate A (1) eap_peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_peap : TLS_accept: SSLv3 write server done A (1) eap_peap : TLS_accept: SSLv3 flush data (1) eap_peap : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) eap_peap : eaptls_process returned 13 (1) eap_peap : FR_TLS_HANDLED (1) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfa960997d (1) [eap] = handled (1) } # authenticate = handled Sending Access-Challenge of id 173 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfa960997d12828dafc6890954 (1) Finished request 1. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=174, length=228 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020400061900 State = 0xa86480cfa960997d12828dafc6890954 Message-Authenticator = 0xbce2adf33028b31939f2dadd25dc21a6 (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) ? if (!User-Name) (2) ? if (!User-Name) -> FALSE (2) ? if (User-Name != "%{tolower:%{User-Name}}") (2) expand: "%{tolower:%{User-Name}}" -> 'dumm' (2) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (2) ? if (User-Name =~ / /) (2) ? if (User-Name =~ / /) -> FALSE (2) ? if (User-Name =~ /@.*@/ ) (2) ? if (User-Name =~ /@.*@/ ) -> FALSE (2) ? if (User-Name =~ /\\.\\./ ) (2) ? if (User-Name =~ /\\.\\./ ) -> FALSE (2) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (2) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (2) ? if (User-Name =~ /\\.$/) (2) ? if (User-Name =~ /\\.$/) -> FALSE (2) ? if (User-Name =~ /(a)\\./) (2) ? if (User-Name =~ /(a)\\./) -> FALSE (2) } # filter_username filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : No '@' in User-Name = "dumm", looking up realm NULL (2) suffix : Found realm "NULL" (2) suffix : Adding Stripped-User-Name = "dumm" (2) suffix : Adding Realm = "NULL" (2) suffix : Authentication realm is LOCAL (2) [suffix] = ok (2) eap : EAP packet type response id 4 length 6 (2) eap : Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) authenticate { (2) eap : Expiring EAP session with state 0xa86480cfa960997d (2) eap : Finished EAP session with state 0xa86480cfa960997d (2) eap : Previous EAP request found for state 0xa86480cfa960997d, released from the list (2) eap : Peer sent PEAP (25) (2) eap : EAP PEAP (25) (2) eap : Calling eap_peap to process EAP data (2) eap_peap : processing EAP-TLS (2) eap_peap : Received TLS ACK (2) eap_peap : Received TLS ACK (2) eap_peap : ACK handshake fragment handler (2) eap_peap : eaptls_verify returned 1 (2) eap_peap : eaptls_process returned 13 (2) eap_peap : FR_TLS_HANDLED (2) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfaa61997d (2) [eap] = handled (2) } # authenticate = handled Sending Access-Challenge of id 174 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfaa61997d12828dafc6890954 (2) Finished request 2. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=175, length=228 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020500061900 State = 0xa86480cfaa61997d12828dafc6890954 Message-Authenticator = 0x6424ccb720f6e6d11e217657449ec5b1 (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) filter_username filter_username { (3) ? if (!User-Name) (3) ? if (!User-Name) -> FALSE (3) ? if (User-Name != "%{tolower:%{User-Name}}") (3) expand: "%{tolower:%{User-Name}}" -> 'dumm' (3) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (3) ? if (User-Name =~ / /) (3) ? if (User-Name =~ / /) -> FALSE (3) ? if (User-Name =~ /@.*@/ ) (3) ? if (User-Name =~ /@.*@/ ) -> FALSE (3) ? if (User-Name =~ /\\.\\./ ) (3) ? if (User-Name =~ /\\.\\./ ) -> FALSE (3) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (3) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (3) ? if (User-Name =~ /\\.$/) (3) ? if (User-Name =~ /\\.$/) -> FALSE (3) ? if (User-Name =~ /(a)\\./) (3) ? if (User-Name =~ /(a)\\./) -> FALSE (3) } # filter_username filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : No '@' in User-Name = "dumm", looking up realm NULL (3) suffix : Found realm "NULL" (3) suffix : Adding Stripped-User-Name = "dumm" (3) suffix : Adding Realm = "NULL" (3) suffix : Authentication realm is LOCAL (3) [suffix] = ok (3) eap : EAP packet type response id 5 length 6 (3) eap : Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/raddb/sites-enabled/default (3) authenticate { (3) eap : Expiring EAP session with state 0xa86480cfaa61997d (3) eap : Finished EAP session with state 0xa86480cfaa61997d (3) eap : Previous EAP request found for state 0xa86480cfaa61997d, released from the list (3) eap : Peer sent PEAP (25) (3) eap : EAP PEAP (25) (3) eap : Calling eap_peap to process EAP data (3) eap_peap : processing EAP-TLS (3) eap_peap : Received TLS ACK (3) eap_peap : Received TLS ACK (3) eap_peap : ACK handshake fragment handler (3) eap_peap : eaptls_verify returned 1 (3) eap_peap : eaptls_process returned 13 (3) eap_peap : FR_TLS_HANDLED (3) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfab62997d (3) [eap] = handled (3) } # authenticate = handled Sending Access-Challenge of id 175 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfab62997d12828dafc6890954 (3) Finished request 3. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=176, length=228 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020600061900 State = 0xa86480cfab62997d12828dafc6890954 Message-Authenticator = 0xed7f6b286401975720341fcbc89f9455 (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4) authorize { (4) filter_username filter_username { (4) ? if (!User-Name) (4) ? if (!User-Name) -> FALSE (4) ? if (User-Name != "%{tolower:%{User-Name}}") (4) expand: "%{tolower:%{User-Name}}" -> 'dumm' (4) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (4) ? if (User-Name =~ / /) (4) ? if (User-Name =~ / /) -> FALSE (4) ? if (User-Name =~ /@.*@/ ) (4) ? if (User-Name =~ /@.*@/ ) -> FALSE (4) ? if (User-Name =~ /\\.\\./ ) (4) ? if (User-Name =~ /\\.\\./ ) -> FALSE (4) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (4) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (4) ? if (User-Name =~ /\\.$/) (4) ? if (User-Name =~ /\\.$/) -> FALSE (4) ? if (User-Name =~ /(a)\\./) (4) ? if (User-Name =~ /(a)\\./) -> FALSE (4) } # filter_username filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : No '@' in User-Name = "dumm", looking up realm NULL (4) suffix : Found realm "NULL" (4) suffix : Adding Stripped-User-Name = "dumm" (4) suffix : Adding Realm = "NULL" (4) suffix : Authentication realm is LOCAL (4) [suffix] = ok (4) eap : EAP packet type response id 6 length 6 (4) eap : Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/raddb/sites-enabled/default (4) authenticate { (4) eap : Expiring EAP session with state 0xa86480cfab62997d (4) eap : Finished EAP session with state 0xa86480cfab62997d (4) eap : Previous EAP request found for state 0xa86480cfab62997d, released from the list (4) eap : Peer sent PEAP (25) (4) eap : EAP PEAP (25) (4) eap : Calling eap_peap to process EAP data (4) eap_peap : processing EAP-TLS (4) eap_peap : Received TLS ACK (4) eap_peap : Received TLS ACK (4) eap_peap : ACK handshake fragment handler (4) eap_peap : eaptls_verify returned 1 (4) eap_peap : eaptls_process returned 13 (4) eap_peap : FR_TLS_HANDLED (4) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfac63997d (4) [eap] = handled (4) } # authenticate = handled Sending Access-Challenge of id 176 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfac63997d12828dafc6890954 (4) Finished request 4. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=177, length=228 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020700061900 State = 0xa86480cfac63997d12828dafc6890954 Message-Authenticator = 0x350c6496caddb678f4145338d352ff5f (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) ? if (!User-Name) (5) ? if (!User-Name) -> FALSE (5) ? if (User-Name != "%{tolower:%{User-Name}}") (5) expand: "%{tolower:%{User-Name}}" -> 'dumm' (5) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (5) ? if (User-Name =~ / /) (5) ? if (User-Name =~ / /) -> FALSE (5) ? if (User-Name =~ /@.*@/ ) (5) ? if (User-Name =~ /@.*@/ ) -> FALSE (5) ? if (User-Name =~ /\\.\\./ ) (5) ? if (User-Name =~ /\\.\\./ ) -> FALSE (5) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (5) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (5) ? if (User-Name =~ /\\.$/) (5) ? if (User-Name =~ /\\.$/) -> FALSE (5) ? if (User-Name =~ /(a)\\./) (5) ? if (User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : No '@' in User-Name = "dumm", looking up realm NULL (5) suffix : Found realm "NULL" (5) suffix : Adding Stripped-User-Name = "dumm" (5) suffix : Adding Realm = "NULL" (5) suffix : Authentication realm is LOCAL (5) [suffix] = ok (5) eap : EAP packet type response id 7 length 6 (5) eap : Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0xa86480cfac63997d (5) eap : Finished EAP session with state 0xa86480cfac63997d (5) eap : Previous EAP request found for state 0xa86480cfac63997d, released from the list (5) eap : Peer sent PEAP (25) (5) eap : EAP PEAP (25) (5) eap : Calling eap_peap to process EAP data (5) eap_peap : processing EAP-TLS (5) eap_peap : Received TLS ACK (5) eap_peap : Received TLS ACK (5) eap_peap : ACK handshake fragment handler (5) eap_peap : eaptls_verify returned 1 (5) eap_peap : eaptls_process returned 13 (5) eap_peap : FR_TLS_HANDLED (5) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfad6c997d (5) [eap] = handled (5) } # authenticate = handled Sending Access-Challenge of id 177 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfad6c997d12828dafc6890954 (5) Finished request 5. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=178, length=560 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020801501980000001461603010106100001020100895db16795383e66c1fbe477e6a32de3bbf7284cedcb90d740413663bb5723b9d64ebc2cd4fc722d68bbb218dd74930a5696ae34e6b6668d6da308cb4f056eaa47e914dfb5afc1ac3ea4060d56430d37b79b3f61203a2f5f13faa11be9ee39f6ad29e894d7fe443569ba4ce8c91245e17b0d198d0bdd5a5a838eaad32d44be2fa954ad8be8ca01c9542f438fd9c2018ccc398b5fc326cd2bd6610d6fe3cc57fbffca875bcd9a93c812ecf0e33f9fcbfd9c11ef94b2f730de6d2745976d5c74521cb4628257351c280ec41f32b9311cde2b72d8cb3919a5d6c8dbbee1542d0014b02ba361ac9a156fd03226538d356541c6f6a3412f5db8251c9a5a25de2ee2c81403010001011603010030119978f0e9951fc0d9d6d4850d606edc4b3339ae5452c58db1699e709dfa5d5e3f910008914565a5b8d435aa41888ce3 State = 0xa86480cfad6c997d12828dafc6890954 Message-Authenticator = 0xa0338b8ac9c33aa4898dff4aaff042fc (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) ? if (!User-Name) (6) ? if (!User-Name) -> FALSE (6) ? if (User-Name != "%{tolower:%{User-Name}}") (6) expand: "%{tolower:%{User-Name}}" -> 'dumm' (6) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (6) ? if (User-Name =~ / /) (6) ? if (User-Name =~ / /) -> FALSE (6) ? if (User-Name =~ /@.*@/ ) (6) ? if (User-Name =~ /@.*@/ ) -> FALSE (6) ? if (User-Name =~ /\\.\\./ ) (6) ? if (User-Name =~ /\\.\\./ ) -> FALSE (6) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (6) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) ? if (User-Name =~ /\\.$/) (6) ? if (User-Name =~ /\\.$/) -> FALSE (6) ? if (User-Name =~ /(a)\\./) (6) ? if (User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : No '@' in User-Name = "dumm", looking up realm NULL (6) suffix : Found realm "NULL" (6) suffix : Adding Stripped-User-Name = "dumm" (6) suffix : Adding Realm = "NULL" (6) suffix : Authentication realm is LOCAL (6) [suffix] = ok (6) eap : EAP packet type response id 8 length 336 (6) eap : Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { (6) eap : Expiring EAP session with state 0xa86480cfad6c997d (6) eap : Finished EAP session with state 0xa86480cfad6c997d (6) eap : Previous EAP request found for state 0xa86480cfad6c997d, released from the list (6) eap : Peer sent PEAP (25) (6) eap : EAP PEAP (25) (6) eap : Calling eap_peap to process EAP data (6) eap_peap : processing EAP-TLS TLS Length 326 (6) eap_peap : Length Included (6) eap_peap : eaptls_verify returned 11 (6) eap_peap : <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange (6) eap_peap : TLS_accept: SSLv3 read client key exchange A (6) eap_peap : <<< TLS 1.0 ChangeCipherSpec [length 0001] (6) eap_peap : <<< TLS 1.0 Handshake [length 0010], Finished (6) eap_peap : TLS_accept: SSLv3 read finished A (6) eap_peap : >>> TLS 1.0 ChangeCipherSpec [length 0001] (6) eap_peap : TLS_accept: SSLv3 write change cipher spec A (6) eap_peap : >>> TLS 1.0 Handshake [length 0010], Finished (6) eap_peap : TLS_accept: SSLv3 write finished A (6) eap_peap : TLS_accept: SSLv3 flush data SSL: adding session e467ff943668da672a3a7da5e39dd0f027275656dc6f0b17019d463e6946fd42 to cache (6) eap_peap : (other): SSL negotiation finished successfully SSL Connection Established (6) eap_peap : eaptls_process returned 13 (6) eap_peap : FR_TLS_HANDLED (6) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfae6d997d (6) [eap] = handled (6) } # authenticate = handled Sending Access-Challenge of id 178 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x01090041190014030100010116030100304363285a0957c59d896553101f3d7e4de5404484f6dea4258eca26e9699b520777556fd173f270a97f987c2e7a01394d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfae6d997d12828dafc6890954 (6) Finished request 6. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=179, length=228 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020900061900 State = 0xa86480cfae6d997d12828dafc6890954 Message-Authenticator = 0xba508282c219aea5755f50bf9de8429e (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) ? if (!User-Name) (7) ? if (!User-Name) -> FALSE (7) ? if (User-Name != "%{tolower:%{User-Name}}") (7) expand: "%{tolower:%{User-Name}}" -> 'dumm' (7) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (7) ? if (User-Name =~ / /) (7) ? if (User-Name =~ / /) -> FALSE (7) ? if (User-Name =~ /@.*@/ ) (7) ? if (User-Name =~ /@.*@/ ) -> FALSE (7) ? if (User-Name =~ /\\.\\./ ) (7) ? if (User-Name =~ /\\.\\./ ) -> FALSE (7) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (7) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) ? if (User-Name =~ /\\.$/) (7) ? if (User-Name =~ /\\.$/) -> FALSE (7) ? if (User-Name =~ /(a)\\./) (7) ? if (User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : No '@' in User-Name = "dumm", looking up realm NULL (7) suffix : Found realm "NULL" (7) suffix : Adding Stripped-User-Name = "dumm" (7) suffix : Adding Realm = "NULL" (7) suffix : Authentication realm is LOCAL (7) [suffix] = ok (7) eap : EAP packet type response id 9 length 6 (7) eap : Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap : Expiring EAP session with state 0xa86480cfae6d997d (7) eap : Finished EAP session with state 0xa86480cfae6d997d (7) eap : Previous EAP request found for state 0xa86480cfae6d997d, released from the list (7) eap : Peer sent PEAP (25) (7) eap : EAP PEAP (25) (7) eap : Calling eap_peap to process EAP data (7) eap_peap : processing EAP-TLS (7) eap_peap : Received TLS ACK (7) eap_peap : Received TLS ACK (7) eap_peap : ACK handshake is finished (7) eap_peap : eaptls_verify returned 3 (7) eap_peap : eaptls_process returned 3 (7) eap_peap : FR_TLS_SUCCESS (7) eap_peap : Session established. Decoding tunneled attributes (7) eap_peap : Peap state TUNNEL ESTABLISHED (7) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfaf6e997d (7) [eap] = handled (7) } # authenticate = handled Sending Access-Challenge of id 179 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x010a002b19001703010020be713b3d1fc2d5f5b78ada5c59f71d259becb60cfd631484fe72a2b116382a42 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfaf6e997d12828dafc6890954 (7) Finished request 7. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=180, length=265 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020a002b19001703010020d1ef31ba5764aeaecaa4d794b45d9412106b7d2d16fab86405e45bf76a79f9fd State = 0xa86480cfaf6e997d12828dafc6890954 Message-Authenticator = 0x390272675aad0fd9a3bb808b7e842d1d (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) filter_username filter_username { (8) ? if (!User-Name) (8) ? if (!User-Name) -> FALSE (8) ? if (User-Name != "%{tolower:%{User-Name}}") (8) expand: "%{tolower:%{User-Name}}" -> 'dumm' (8) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (8) ? if (User-Name =~ / /) (8) ? if (User-Name =~ / /) -> FALSE (8) ? if (User-Name =~ /@.*@/ ) (8) ? if (User-Name =~ /@.*@/ ) -> FALSE (8) ? if (User-Name =~ /\\.\\./ ) (8) ? if (User-Name =~ /\\.\\./ ) -> FALSE (8) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (8) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (8) ? if (User-Name =~ /\\.$/) (8) ? if (User-Name =~ /\\.$/) -> FALSE (8) ? if (User-Name =~ /(a)\\./) (8) ? if (User-Name =~ /(a)\\./) -> FALSE (8) } # filter_username filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : No '@' in User-Name = "dumm", looking up realm NULL (8) suffix : Found realm "NULL" (8) suffix : Adding Stripped-User-Name = "dumm" (8) suffix : Adding Realm = "NULL" (8) suffix : Authentication realm is LOCAL (8) [suffix] = ok (8) eap : EAP packet type response id 10 length 43 (8) eap : Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { (8) eap : Expiring EAP session with state 0xa86480cfaf6e997d (8) eap : Finished EAP session with state 0xa86480cfaf6e997d (8) eap : Previous EAP request found for state 0xa86480cfaf6e997d, released from the list (8) eap : Peer sent PEAP (25) (8) eap : EAP PEAP (25) (8) eap : Calling eap_peap to process EAP data (8) eap_peap : processing EAP-TLS (8) eap_peap : eaptls_verify returned 7 (8) eap_peap : Done initial handshake (8) eap_peap : eaptls_process returned 7 (8) eap_peap : FR_TLS_OK (8) eap_peap : Session established. Decoding tunneled attributes (8) eap_peap : Peap state WAITING FOR INNER IDENTITY (8) eap_peap : Identity - dumm (8) eap_peap : Got inner identity 'dumm' (8) eap_peap : Setting default EAP type for tunneled EAP session (8) eap_peap : Got tunneled request EAP-Message = 0x020a00090164756d6d server default { (8) eap_peap : Setting User-Name to dumm Sending tunneled request EAP-Message = 0x020a00090164756d6d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'dumm' server inner-tunnel { (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) [chap] = noop (8) [mschap] = noop (8) suffix : No '@' in User-Name = "dumm", looking up realm NULL (8) suffix : Found realm "NULL" (8) suffix : Adding Stripped-User-Name = "dumm" (8) suffix : Adding Realm = "NULL" (8) suffix : Authentication realm is LOCAL (8) [suffix] = ok (8) update control { (8) Proxy-To-Realm := 'LOCAL' (8) } # update control = noop (8) eap : EAP packet type response id 10 length 9 (8) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Peer sent Identity (1) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : Issuing Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xee5b016dee501bdf (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel (8) eap_peap : Got tunneled reply code 11 EAP-Message = 0x010b001e1a010b0019109661dbd36e0ae001fea904bee60562ae64756d6d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee5b016dee501bdf8d4c45a0081cd9a7 (8) eap_peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x010b001e1a010b0019109661dbd36e0ae001fea904bee60562ae64756d6d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee5b016dee501bdf8d4c45a0081cd9a7 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfa06f997d (8) [eap] = handled (8) } # authenticate = handled Sending Access-Challenge of id 180 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x010b005b1900170301005073ea643c33410b75bddafebb5c6dfcb84d36924a83410e9111f31a559c3dd1583d191d435a92bab18f28ffe91e6e877127f7ad007cfbfacaead6ab6ba3a224bdad252b5049a926b9031d12e1dfa0f57d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfa06f997d12828dafc6890954 (8) Finished request 8. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=181, length=313 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020b005b190017030100501e92d5aac9bc32d3633a445500b65cf43ba2fafff188597ff64350f659c20099cd4d3cc1b46e10d3af5d214a9117445e49ff1d0117cded672220a5889795b4b0a148f0bd43b5e703cec7f0a4271868a7 State = 0xa86480cfa06f997d12828dafc6890954 Message-Authenticator = 0xd1a70dbde1b61df2d5cb92820834b904 (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) filter_username filter_username { (9) ? if (!User-Name) (9) ? if (!User-Name) -> FALSE (9) ? if (User-Name != "%{tolower:%{User-Name}}") (9) expand: "%{tolower:%{User-Name}}" -> 'dumm' (9) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (9) ? if (User-Name =~ / /) (9) ? if (User-Name =~ / /) -> FALSE (9) ? if (User-Name =~ /@.*@/ ) (9) ? if (User-Name =~ /@.*@/ ) -> FALSE (9) ? if (User-Name =~ /\\.\\./ ) (9) ? if (User-Name =~ /\\.\\./ ) -> FALSE (9) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (9) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (9) ? if (User-Name =~ /\\.$/) (9) ? if (User-Name =~ /\\.$/) -> FALSE (9) ? if (User-Name =~ /(a)\\./) (9) ? if (User-Name =~ /(a)\\./) -> FALSE (9) } # filter_username filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : No '@' in User-Name = "dumm", looking up realm NULL (9) suffix : Found realm "NULL" (9) suffix : Adding Stripped-User-Name = "dumm" (9) suffix : Adding Realm = "NULL" (9) suffix : Authentication realm is LOCAL (9) [suffix] = ok (9) eap : EAP packet type response id 11 length 91 (9) eap : Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap : Expiring EAP session with state 0xee5b016dee501bdf (9) eap : Finished EAP session with state 0xa86480cfa06f997d (9) eap : Previous EAP request found for state 0xa86480cfa06f997d, released from the list (9) eap : Peer sent PEAP (25) (9) eap : EAP PEAP (25) (9) eap : Calling eap_peap to process EAP data (9) eap_peap : processing EAP-TLS (9) eap_peap : eaptls_verify returned 7 (9) eap_peap : Done initial handshake (9) eap_peap : eaptls_process returned 7 (9) eap_peap : FR_TLS_OK (9) eap_peap : Session established. Decoding tunneled attributes (9) eap_peap : Peap state phase2 (9) eap_peap : EAP type MSCHAPv2 (26) (9) eap_peap : Got tunneled request EAP-Message = 0x020b003f1a020b003a313eb867d7b4cd2ac386791c7fcbb3317400000000000000003772c1653fd3f345180b5ba9bd0c862349062d4fa8c63d530064756d6d server default { (9) eap_peap : Setting User-Name to dumm Sending tunneled request EAP-Message = 0x020b003f1a020b003a313eb867d7b4cd2ac386791c7fcbb3317400000000000000003772c1653fd3f345180b5ba9bd0c862349062d4fa8c63d530064756d6d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'dumm' State = 0xee5b016dee501bdf8d4c45a0081cd9a7 server inner-tunnel { (9) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (9) authorize { (9) [chap] = noop (9) [mschap] = noop (9) suffix : No '@' in User-Name = "dumm", looking up realm NULL (9) suffix : Found realm "NULL" (9) suffix : Adding Stripped-User-Name = "dumm" (9) suffix : Adding Realm = "NULL" (9) suffix : Authentication realm is LOCAL (9) [suffix] = ok (9) update control { (9) Proxy-To-Realm := 'LOCAL' (9) } # update control = noop (9) eap : EAP packet type response id 11 length 63 (9) eap : No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) [files] = noop rlm_ldap (ldap): Reserved connection (2) (9) ldap : expand: "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(cn=dumm)' (9) ldap : expand: "o=org" -> 'o=org' (9) ldap : Performing search in 'o=org' with filter '(cn=dumm)' (9) ldap : Waiting for search result... (9) ldap : User object found at DN "cn=dumm,ou=test1,ou=test,o=org" (9) ldap : Added eDirectory password in check items as Cleartext-Password = pwddummy (9) ldap : Binding as user for eDirectory authorization checks (9) ldap : Waiting for bind result... (9) ldap : Bind successful (9) ldap : Bind as user "cn=dumm,ou=test1,ou=test,o=org" was successful rlm_ldap (ldap): Released connection (2) (9) [ldap] = ok (9) [expiration] = noop (9) [logintime] = noop (9) WARNING: pap : Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = EAP (9) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap : Expiring EAP session with state 0xee5b016dee501bdf (9) eap : Finished EAP session with state 0xee5b016dee501bdf (9) eap : Previous EAP request found for state 0xee5b016dee501bdf, released from the list (9) eap : Peer sent MSCHAPv2 (26) (9) eap : EAP MSCHAPv2 (26) (9) eap : Calling eap_mschapv2 to process EAP data (9) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (9) eap_mschapv2 : Auth-Type MS-CHAP { (9) mschap : Creating challenge hash with username: dumm (9) mschap : Client is using MS-CHAPv2 for dumm, we need NT-Password (9) mschap : adding MS-CHAPv2 MPPE keys (9) [mschap] = ok (9) } # Auth-Type MS-CHAP = ok MSCHAP Success (9) eap : New EAP session, adding 'State' attribute to reply 0xee5b016def571bdf (9) [eap] = handled (9) } # authenticate = handled } # server inner-tunnel (9) eap_peap : Got tunneled reply code 11 EAP-Message = 0x010c00331a030b002e533d33393932423341383241334531364636313133364145443537463742314531383142423232323739 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee5b016def571bdf8d4c45a0081cd9a7 (9) eap_peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x010c00331a030b002e533d33393932423341383241334531364636313133364145443537463742314531383142423232323739 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee5b016def571bdf8d4c45a0081cd9a7 (9) eap_peap : Got tunneled Access-Challenge (9) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfa168997d (9) [eap] = handled (9) } # authenticate = handled Sending Access-Challenge of id 181 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x010c008b1900170301008046339821146757e1169814d336fa5f44c5ce7a0e601f78caedb3fd62a4fa62b2f7d8d34cc19780af80a57723dadd2585f7fa37d7cdca90f4cdb16b2d35e36f36c6a4bcb7638a02e9dd200cde370816f25c171bc348b6a5282ae214face960bd0eede6e44d5006125861933e0fdc966b82a9a03e63641d184d1c5244f6023ecae Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfa168997d12828dafc6890954 (9) Finished request 9. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=182, length=265 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020c002b19001703010020b0ac95690bead98890fb01b1789e3dcdc33e358f214f171ebe643ab87330ea1a State = 0xa86480cfa168997d12828dafc6890954 Message-Authenticator = 0x7c14084404119159c3d9e6416e0a8110 (10) # Executing section authorize from file /etc/raddb/sites-enabled/default (10) authorize { (10) filter_username filter_username { (10) ? if (!User-Name) (10) ? if (!User-Name) -> FALSE (10) ? if (User-Name != "%{tolower:%{User-Name}}") (10) expand: "%{tolower:%{User-Name}}" -> 'dumm' (10) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (10) ? if (User-Name =~ / /) (10) ? if (User-Name =~ / /) -> FALSE (10) ? if (User-Name =~ /@.*@/ ) (10) ? if (User-Name =~ /@.*@/ ) -> FALSE (10) ? if (User-Name =~ /\\.\\./ ) (10) ? if (User-Name =~ /\\.\\./ ) -> FALSE (10) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (10) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (10) ? if (User-Name =~ /\\.$/) (10) ? if (User-Name =~ /\\.$/) -> FALSE (10) ? if (User-Name =~ /(a)\\./) (10) ? if (User-Name =~ /(a)\\./) -> FALSE (10) } # filter_username filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix : No '@' in User-Name = "dumm", looking up realm NULL (10) suffix : Found realm "NULL" (10) suffix : Adding Stripped-User-Name = "dumm" (10) suffix : Adding Realm = "NULL" (10) suffix : Authentication realm is LOCAL (10) [suffix] = ok (10) eap : EAP packet type response id 12 length 43 (10) eap : Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = EAP (10) # Executing group from file /etc/raddb/sites-enabled/default (10) authenticate { (10) eap : Expiring EAP session with state 0xee5b016def571bdf (10) eap : Finished EAP session with state 0xa86480cfa168997d (10) eap : Previous EAP request found for state 0xa86480cfa168997d, released from the list (10) eap : Peer sent PEAP (25) (10) eap : EAP PEAP (25) (10) eap : Calling eap_peap to process EAP data (10) eap_peap : processing EAP-TLS (10) eap_peap : eaptls_verify returned 7 (10) eap_peap : Done initial handshake (10) eap_peap : eaptls_process returned 7 (10) eap_peap : FR_TLS_OK (10) eap_peap : Session established. Decoding tunneled attributes (10) eap_peap : Peap state phase2 (10) eap_peap : EAP type MSCHAPv2 (26) (10) eap_peap : Got tunneled request EAP-Message = 0x020c00061a03 server default { (10) eap_peap : Setting User-Name to dumm Sending tunneled request EAP-Message = 0x020c00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'dumm' State = 0xee5b016def571bdf8d4c45a0081cd9a7 server inner-tunnel { (10) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (10) authorize { (10) [chap] = noop (10) [mschap] = noop (10) suffix : No '@' in User-Name = "dumm", looking up realm NULL (10) suffix : Found realm "NULL" (10) suffix : Adding Stripped-User-Name = "dumm" (10) suffix : Adding Realm = "NULL" (10) suffix : Authentication realm is LOCAL (10) [suffix] = ok (10) update control { (10) Proxy-To-Realm := 'LOCAL' (10) } # update control = noop (10) eap : EAP packet type response id 12 length 6 (10) eap : EAP-MSCHAPV2 success, returning short-circuit ok (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = EAP (10) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (10) authenticate { (10) eap : Expiring EAP session with state 0xee5b016def571bdf (10) eap : Finished EAP session with state 0xee5b016def571bdf (10) eap : Previous EAP request found for state 0xee5b016def571bdf, released from the list (10) eap : Peer sent MSCHAPv2 (26) (10) eap : EAP MSCHAPv2 (26) (10) eap : Calling eap_mschapv2 to process EAP data (10) eap : Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) Login OK: [dumm/<via Auth-Type = EAP>] (from client uni port 0 via TLS tunnel) (10) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (10) post-auth { (10) reply_log : expand: "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" -> '/var/log/radacct/xxx.xx.xxx.x/reply-detail-20131218' (10) reply_log : /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radacct/xxx.xx.xxx.x/reply-detail-20131218 (10) reply_log : expand: "%t" -> 'Wed Dec 18 13:34:42 2013' (10) [reply_log] = ok (10) ldap : expand: "." -> '.' (10) ldap : expand: "Authenticated at %S" -> 'Authenticated at 2013-12-18 13:34:42' rlm_ldap (ldap): Reserved connection (2) (10) ldap : Waiting for bind result... (10) ldap : Bind successful (10) ldap : expand: "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(cn=dumm)' (10) ldap : expand: "o=org" -> 'o=org' (10) ldap : Performing search in 'o=org' with filter '(cn=dumm)' (10) ldap : Waiting for search result... (10) ldap : User object found at DN "cn=dumm,ou=test1,ou=test,o=org" (10) ldap : Modifying object with DN "cn=dumm,ou=test1,ou=test,o=org" (10) ldap : Waiting for modify result... rlm_ldap (ldap): Released connection (2) (10) [ldap] = reject (10) } # post-auth = reject } # server inner-tunnel (10) eap_peap : Got tunneled reply code 3 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed MS-MPPE-Send-Key = 0x30a31126813a40c345aeaa9b3c725a4f MS-MPPE-Recv-Key = 0x3d6d7a5365ac052cd38b9f526e56747d EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Stripped-User-Name = 'dumm' (10) eap_peap : Got tunneled reply RADIUS code 3 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed MS-MPPE-Send-Key = 0x30a31126813a40c345aeaa9b3c725a4f MS-MPPE-Recv-Key = 0x3d6d7a5365ac052cd38b9f526e56747d EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Stripped-User-Name = 'dumm' (10) eap_peap : Tunneled authentication was rejected (10) eap_peap : FAILURE (10) eap : New EAP session, adding 'State' attribute to reply 0xa86480cfa269997d (10) [eap] = handled (10) } # authenticate = handled Sending Access-Challenge of id 182 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x010d002b19001703010020b5173c1b2cec565ddf2100e27bc0bea6358257604cbf176f1e6b006c028fccb9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa86480cfa269997d12828dafc6890954 (10) Finished request 10. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host xxx.xx.xxx.x port 32770, id=183, length=265 User-Name = 'dumm' Calling-Station-Id = 'xx-xx-xx-xx-xx-xx' Called-Station-Id = 'xx-xx-xx-xx-xx-xx:test' NAS-Port = 1 Cisco-AVPair = 'audit-session-id=8b0ec8060004498d52b19663' NAS-IP-Address = xxx.xx.xxx.x NAS-Identifier = 'cisco' Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '219' EAP-Message = 0x020d002b19001703010020c712a6ac4a0db2089c88254691e2fc91f9efdff20bffff880f830a5a22706162 State = 0xa86480cfa269997d12828dafc6890954 Message-Authenticator = 0xdfd550bec019140e91d79fe8c9eb081a (11) # Executing section authorize from file /etc/raddb/sites-enabled/default (11) authorize { (11) filter_username filter_username { (11) ? if (!User-Name) (11) ? if (!User-Name) -> FALSE (11) ? if (User-Name != "%{tolower:%{User-Name}}") (11) expand: "%{tolower:%{User-Name}}" -> 'dumm' (11) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (11) ? if (User-Name =~ / /) (11) ? if (User-Name =~ / /) -> FALSE (11) ? if (User-Name =~ /@.*@/ ) (11) ? if (User-Name =~ /@.*@/ ) -> FALSE (11) ? if (User-Name =~ /\\.\\./ ) (11) ? if (User-Name =~ /\\.\\./ ) -> FALSE (11) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (11) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (11) ? if (User-Name =~ /\\.$/) (11) ? if (User-Name =~ /\\.$/) -> FALSE (11) ? if (User-Name =~ /(a)\\./) (11) ? if (User-Name =~ /(a)\\./) -> FALSE (11) } # filter_username filter_username = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix : No '@' in User-Name = "dumm", looking up realm NULL (11) suffix : Found realm "NULL" (11) suffix : Adding Stripped-User-Name = "dumm" (11) suffix : Adding Realm = "NULL" (11) suffix : Authentication realm is LOCAL (11) [suffix] = ok (11) eap : EAP packet type response id 13 length 43 (11) eap : Continuing tunnel setup (11) [eap] = ok (11) } # authorize = ok (11) Found Auth-Type = EAP (11) # Executing group from file /etc/raddb/sites-enabled/default (11) authenticate { (11) eap : Expiring EAP session with state 0xa86480cfa269997d (11) eap : Finished EAP session with state 0xa86480cfa269997d (11) eap : Previous EAP request found for state 0xa86480cfa269997d, released from the list (11) eap : Peer sent PEAP (25) (11) eap : EAP PEAP (25) (11) eap : Calling eap_peap to process EAP data (11) eap_peap : processing EAP-TLS (11) eap_peap : eaptls_verify returned 7 (11) eap_peap : Done initial handshake (11) eap_peap : eaptls_process returned 7 (11) eap_peap : FR_TLS_OK (11) eap_peap : Session established. Decoding tunneled attributes (11) eap_peap : Peap state send tlv failure (11) eap_peap : Received EAP-TLV response (11) eap_peap : The users session was previously rejected: returning reject (again.) (11) eap_peap : *** This means you need to read the PREVIOUS messages in the debug output (11) eap_peap : *** to find out the reason why the user was rejected (11) eap_peap : *** Look for "reject" or "fail". Those earlier messages will tell you (11) eap_peap : *** what went wrong, and how to fix the problem SSL: Removing session e467ff943668da672a3a7da5e39dd0f027275656dc6f0b17019d463e6946fd42 from the cache (11) ERROR: eap : Failed continuing EAP PEAP (25) session. EAP sub-module failed (11) eap : Failed in EAP select (11) [eap] = invalid (11) } # authenticate = invalid (11) Failed to authenticate the user (11) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [dumm/<via Auth-Type = EAP>] (from client uni port 1 cli xx-xx-xx-xx-xx-xx) (11) Using Post-Auth-Type Reject (11) # Executing group from file /etc/raddb/sites-enabled/default (11) Post-Auth-Type REJECT { (11) attr_filter.access_reject : expand: "%{User-Name}" -> 'dumm' (11) attr_filter.access_reject : Matched entry DEFAULT at line 11 (11) [attr_filter.access_reject] = updated (11) ldap : expand: "." -> '.' (11) ldap : expand: "Authenticated at %S" -> 'Authenticated at 2013-12-18 13:34:42' rlm_ldap (ldap): Reserved connection (2) (11) ldap : expand: "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(cn=dumm)' (11) ldap : expand: "o=org" -> 'o=org' (11) ldap : Performing search in 'o=org' with filter '(cn=dumm)' (11) ldap : Waiting for search result... (11) ldap : User object found at DN "cn=dumm,ou=test1,ou=test,o=org" (11) ldap : Modifying object with DN "cn=dumm,ou=test1,ou=test,o=org" (11) ldap : Waiting for modify result... rlm_ldap (ldap): Released connection (2) (11) [ldap] = reject (11) } # Post-Auth-Type REJECT = reject (11) Finished request 11. Waking up in 0.1 seconds. Waking up in 0.6 seconds. (11) Sending delayed reject Sending Access-Reject of id 183 from xxx.xx.x.xx port 1812 to xxx.xx.xxx.x port 32770 EAP-Message = 0x040d0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (0) Cleaning up request packet ID 172 with timestamp +22 (1) Cleaning up request packet ID 173 with timestamp +22 (2) Cleaning up request packet ID 174 with timestamp +22 (3) Cleaning up request packet ID 175 with timestamp +22 (4) Cleaning up request packet ID 176 with timestamp +22 (5) Cleaning up request packet ID 177 with timestamp +22 (6) Cleaning up request packet ID 178 with timestamp +22 (7) Cleaning up request packet ID 179 with timestamp +22 (8) Cleaning up request packet ID 180 with timestamp +22 (9) Cleaning up request packet ID 181 with timestamp +22 (10) Cleaning up request packet ID 182 with timestamp +22 Waking up in 1.0 seconds. (11) Cleaning up request packet ID 183 with timestamp +22 Ready to process requests Signalled to terminate Exiting normally rlm_ldap (ldap): Removing connection pool rlm_ldap (ldap): Closing connection (2) rlm_ldap (ldap): Closing connection (1) rlm_ldap (ldap): Closing connection (0)

4 4

Eap - Sim Server
by Greg Jetter 18 Dec '13

18 Dec '13

Hello : I'm new to freeradius , still learning the basics , what i'm trying to do is set up an freeradius eap-sim server for a telco that has both access to sim's as well as access to a HLR and HHS . I've been lurking on the list a wile so here goes with a few questions. Hopeful not to stupid .... Are there any "How to's" that show in detail how to set this up ? I've found lots of info on the different forms of EAP but not much on EAP-SIM. The end result of the whole thing is to let a user's phone get authorized and authenticated using the SIM card in the phone. doing so with freeradius . from the modules/Rlm_eap docs: "To configure EAP-SIM authentication, the following attributes must be set in the server. This can be done in the users file, but in many cases will be taken from a database server, via one of the SQL interface. If one has SIM cards that one controls (i.e. whose share secret you know), one should be able to write a module to generate these attributes (the triplets) in the server. If one has access to the SS7 based settlement network, then a module to fetch appropriate triplets could be written. This module would act as an authorization only module. The attributes are: EAP-Sim-Rand1 16 bytes EAP-Sim-SRES1 4 bytes EAP-Sim-KC1 8 bytes EAP-Sim-Rand2 16 bytes EAP-Sim-SRES2 4 bytes EAP-Sim-KC2 8 bytes EAP-Sim-Rand3 16 bytes EAP-Sim-SRES3 4 bytes EAP-Sim-KC3 8 bytes EAP-SIM will send WEP attributes to the resquestor." Some questions , if I know the shared secret , how is that used to generate the attributes ? any guides out there for this ? I also have access to a SS7 network , any examples on how to write a module to fetch the attributes from there ? As I stated before I'm "NEW" at this , I've been working with radius for a few weeks , mainly using it in conjunction with a learning book called FreeRadius Beginners guide. I'm trying to do this project with Open Source Free Software to show the company it's possible . Sure we could just buy a canned solution but I'm a supporter of Open source and I believe it can be done. any help would be appreciated , just some pointers to resources if you know of any , or if you have successfully done this how did you accomplish it ? Thanks for your time Greg

2 3

RE: SQL MAC Authentication
by Christopher Kuhn 18 Dec '13

18 Dec '13

> It often helps to see if you can break down the problem into > independent pieces. Does EAP work elsewhere? etc. As I mentioned, it is successfully authenticating supplicants using PEAP-MSCHAP against an AD database. >>The debug output: >> >> Ready to process requests. >> rad_recv: Access-Request packet from host 10.25.22.31 port 49181, >> id=0, length=118 > > NAS-IP-Address = 10.25.22.31 > > NAS-Port-Type = Ethernet > > NAS-Port = 76 > > User-Name = "28d2441b77c9" > > Acct-Session-Id = "050004EE" > > Calling-Station-Id = "28-D2-44-1B-77-C9" > > EAP-Message = 0x0200001101323864323434316237376339 >> Message-Authenticator = 0x0c1c468757ad8814bb6dae782e1ac927 > > Which looks like EAP, not a MAC auth request. It seems that the switch simply extracts the soruce MAC from any traffic, then sends that as the username and password. This actually seems desirable, as it doesn't require an actual 802.1X supplicant on the user end, and I would think this would allow FreeRADIUS to process it like any standard EAP request. >> WARNING: !! EAP session for state 0x8246357d82472c19 did not finish! >> WARNING: !! Please read >> http://wiki.freeradius.org/Certificate_Compatibility > > That should be a hint. Did you read that page? Yes; although that warning appears in the debug logs for our current auth method, it has not interfered with authentication thus far. >> [eap] Response appears to match, but EAP type is wrong. > > The EAP supplicant is broken. FreeRADIUS sent it PEAP, and it > responded with EAP-MD5. > > Take the switch, and throw it in the garbage. It's garbage. The switch is *not* garbage. It's one of half a dozen SG500's in the network, which, general reliability aside, have a 0% chance of being replaced. Regardless, how did you know it was EAP-MD5? And is that the reason for its failure? >> 1) Why does finding the user in SQL not seem to count for authentication (is it supposed to return updated)? > > Because that's how it works. Finding the user is just ONE piece that's > required. If you put gas in your car, it might not move. It still > needs tires, and engine, etc. So are the other parts in this analogy radreply items, or something I don't quite grasp? >> 2) Why does FreeRADIUS continue on to try LDAP, even showing it as the exclusive reason for failure? > > You told it to use SQL then LDAP. And no, it does *not* show LDAP as > the exclusive reason for failure. Read the debug log. Okay, will do. I just assumed from the > Login incorrect ( [ldap] User not found): [28d2441b77c9] part of the log. >> 3) What am I missing that will cause an Access-Accept if a user is found in SQL? > > Because EAP requires a series of back & forth messages in lock-step. > The server is doing it correctly. The switch isn't. So the problem is the EAP type mismatch with the switch?

2 1

Re: Failed to Authenticate Cisco WLC 5508 to FreeRadius Server by using EAP.
by Poon Weng Chee 18 Dec '13

18 Dec '13

Dear A.L.M.Buxey, Thanks for your info, by the way today I tested using the URL below, http://deployingradius.com/documents/configuration/pap.html I tested locally, it works, "radtest bob hello localhost 0 testing123" Return, "rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, length=20" And I tested from the Windows Client to connect the WiFi AP. I successfully to authenticated the Radius server and connected the WiFi AP. But when I trying to using the LDAP user to connect the WiFi AP, it is failed. As you mentioned, "the auth failed because your LDAP stuff isnt right." Is it my configuration on LDAP stuff is incorrect? Do I need to setup the certificate (Production Certificate)? I did a research online, most of the people mentioned the cert need to be create if using EAP/PEAP. Any idea about this? But how come I can connect the test user "bob" without generating any certificate? Really appreciate for your help, hope you can help me on this. Thanks & Regards, Weng Chee DISCLAIMER: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you are not the intended recipient or the person responsible, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please immediately notify us. Thank you.

2 1

URL fix
by Alberto Martínez 18 Dec '13

18 Dec '13

In http://freeradius.org/download.html <a href="http://packages.ubuntu.com/hardy/source/freeradius">Ubuntu</a> --> <a href="http://packages.ubuntu.com/precise/source/freeradius ">Ubuntu</a> -- Alberto Martínez Setién Servicio Informático Universidad de Deusto Avda. de las Universidades, 24 48007 - Bilbao (SPAIN) Phone: +34 - 94 413 90 00 Ext 2684 Fax: +34 - 94 413 91 01

2 2

FR 3.0 with eDir
by Hubert Kupper 18 Dec '13

18 Dec '13

Hello, has anyone sucessfully istalled FR 3.0 with authentication against eDirectory and ldap? I get the following error: "WARNING: ldap : Failed to retrieve eDirectory password" The following options are set in the ldap modul: edir = yes edir_autz = yes With FR 2.x everything works fine. Best regards, Hubert

5 29

802.1x using Active Directory as Freeradius's Backed
by Andi Mappesona 18 Dec '13

18 Dec '13

Hi All, My company will implement WPA2-Enterprise as wireless user authentication method. We already use Active Directory so we want use that AD as authentication service for freeradius too. I already config the freeradius based on these link : http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… this link http://deployingradius.com/documents/configuration/active_directory.html https://www.eduroam.us/node/44 but no good so far, we always failed to authenticate users. Attached debug output. Regards Andi Mappesona

3 3